An access record processing method and device, and a storage medium

Abstract

The embodiment of the application discloses an access record processing method, device and storage medium, the access record processing method comprises: obtaining the historical access record of a user; the historical access record comprises the page identifier of an access page and the reference information of the access page; a page node corresponding to the access page and / or reference information is generated; the connection relationship between the page nodes is determined based on the reference information of the access page; and a page access path tree is constructed according to the page node and the connection relationship between the page nodes. The access record processing method, device and storage medium provided by the application can quickly and effectively analyze the access record of a user, achieve the technical effects of page access frequency statistics and abnormal page judgment, improve the data analysis efficiency, and improve the data processing method.

Description

[0001] This application is a divisional application of patent application filed on January 13, 2017, with application number 201710024279.0 and entitled "A method, apparatus and data analysis method for detecting abnormal access pages". Technical Field

[0002] This application relates to the field of network data communication technology, and in particular to an access record processing method, apparatus and storage medium. Background Technology

[0003] With the continuous development of network data communication technology, website servers can typically collect users' browsing records when they visit a website. By analyzing these records, it's possible to understand user behavior while browsing the website. For example, shopping websites can analyze users' browsing history to determine which products they are interested in, and then push relevant product information to them.

[0004] Currently, when users access websites through client applications, the website's server and the user's client can typically engage in automatic data interaction. For example, the website's server can send an information retrieval request to the user's client. Upon receiving this request, the client can simulate the user's access behavior and send user information back to the website's server. In this process, the access records sent by the user's client to the website's server are not the user's actual access records, and the pages contained in these access records usually cannot be displayed correctly. To accurately analyze user behavior, it is usually necessary to detect abnormal access pages and remove them from the user's access records.

[0005] In existing technologies, when detecting abnormal access pages, a manual screening method can be used. The URL contained in each access record is entered into the browser. If the browser cannot display the page normally, it indicates that the entered URL is an abnormal URL. Thus, the page corresponding to the abnormal URL is also an abnormal access page.

[0006] The current method of manually detecting abnormal access pages requires a considerable amount of time to detect abnormal access pages when faced with a massive number of access records. This results in low efficiency in detecting abnormal access pages, which in turn reduces the efficiency of analyzing user behavior. Summary of the Invention

[0007] The purpose of this application is to provide an access record processing method, apparatus, and storage medium that can improve the efficiency of access record processing and analysis.

[0008] To achieve the above objectives, one embodiment of this application provides an access record processing method, the method comprising: obtaining a user's historical access records; the historical access records including page identifiers of accessed pages and reference information of the accessed pages; generating page nodes corresponding to the accessed pages and / or reference information; determining the connection relationships between page nodes based on the reference information of the accessed pages; and constructing a page access path tree according to the page nodes and the connection relationships between page nodes.

[0009] To achieve the above objectives, another aspect of this application provides an access record processing apparatus, the apparatus comprising: a historical access record acquisition module, configured to acquire a user's historical access records; the historical access records include page identifiers of accessed pages and reference information of the accessed pages; a page node generation module, configured to generate page nodes corresponding to the accessed pages and / or reference information; a connection relationship determination module, configured to determine the connection relationships between page nodes based on the reference information of the accessed pages; and a page access path tree construction module, configured to construct a page access path tree according to the page nodes and the connection relationships between page nodes.

[0010] To achieve the above objectives, another aspect of this application provides a computer-readable storage medium storing computer instructions that, when executed, implement the above-described access record processing method.

[0011] As can be seen from the above, the access record processing method, apparatus and storage medium provided in this application, after obtaining the user's historical access records, constructs page nodes based on the accessed pages and reference information of the accessed pages, and determines the connection relationship between page nodes based on the reference information, thereby generating a page access path tree corresponding to the historical access records. This enables effective and rapid analysis of the user's access records, achieving technical effects such as page access count statistics and abnormal page judgment, improving data analysis efficiency and data processing methods. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0013] Figure 1 A flowchart illustrating a method for detecting abnormal access pages provided in this application.

[0014] Figure 2This is a schematic diagram of the page access path tree in the embodiments of this application;

[0015] Figure 3 This is a schematic diagram of the structure of the abnormal page access detection device in the embodiments of this application;

[0016] Figure 4 This is a flowchart of the data analysis method in the embodiments of this application. Detailed Implementation

[0017] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0018] This application provides a method for detecting abnormal page access. Please refer to [link / reference]. Figure 1 The method includes the following steps.

[0019] S1: Obtain the user's historical access records, which include the page identifier of the accessed page and the reference information of the accessed page.

[0020] In this embodiment, when a user accesses a preset website through a client, they can send an access request to the server of the preset website. The access request may include an identifier pointing to the preset website. For example, the identifier may be the domain name of the preset website or the IP address of the server of the preset website. When the identifier is the domain name of the preset website, the user's client can resolve the domain name through a Domain Name System (DNS) server to obtain the IP address corresponding to the domain name. In this way, the user's client can send the access request to the server pointed to by the resolved IP address.

[0021] In this embodiment, the access request may also include the IP address of the user's client. Thus, when the server of the preset website receives the access request from the user's client, it can send page information corresponding to the access request to the IP address of the user's client. In this way, the user's client can receive the page information sent by the server of the preset website and display that page information on the current page.

[0022] In this embodiment, during a user's access to a preset website, the server of the preset website can collect the user's access records. Specifically, collecting user access records can include saving each user's access request or adding a script for obtaining user information to the page information returned to the user's client. Thus, when the user's client receives the page information returned by the server, it can execute the script added to the page information, thereby sending the user's information from the client to the server of the preset website. In this embodiment, the user information may include browser information, access time, cookie information, etc.

[0023] In this embodiment, after the server of the preset website collects the user's access records, it can store these records in a preset memory. The preset memory can be located within the server of the preset website, or it can function as a separate storage server accessible by the server of the preset website.

[0024] In this embodiment, the user's access records stored in the preset memory can serve as the user's historical access records. Historical access records belonging to the same user in the preset memory can share the same user identifier. This user identifier can be an account registered by the user on the preset website, or it can be the user's client IP address. Thus, different historical access records can be retrieved from the preset memory based on different user identifiers.

[0025] In this embodiment, obtaining a user's historical access records can include reading historical access records corresponding to a user identifier from the preset memory. Specifically, the detection device for abnormal access pages can provide a data retrieval request containing the user identifier to the server of the preset website. In this way, the server of the preset website can extract the user identifier from the data retrieval request, and thus can feed back the historical access data corresponding to the user identifier to the detection device. In this embodiment, the detection device can be an independent electronic device with data processing functions, or it can be a program running on the electronic device or the server of the preset website.

[0026] In this embodiment, the user's historical access record typically includes a page identifier of the accessed page and referencing information for that page. The page identifier can be a string pointing to the accessed page. For example, the page identifier can be a Uniform Resource Locator (URL). The referencing information indicates which page the accessed page was linked from. The referencing information can include the page identifier of the parent page of the accessed page. For example, the page identifier of the accessed page can be www.jd.com, and the referencing information includes the page identifier of www.google.com. This indicates that the accessed page from www.jd.com was linked from www.google.com.

[0027] In this embodiment, each access record in the historical access log can be written according to a fixed format. This fixed format can define the various components of the access record and their order. For example, the access record may include an accessed page field and a referencing page field, each starting with a pre-defined header identifier. For instance, the header identifier for the accessed page field could be "Request:", and for the referencing page field, it could be "Referer:". Following the header identifier, the page identifier of the accessed page or the page identifier of the referencing page can be filled in, respectively.

[0028] S3: Based on the page identifier and the reference information, count the number of times each page is accessed in the historical access records and record the reference data corresponding to each page.

[0029] In this embodiment, the page identifier contained in the historical access record can point to the accessed page, and the reference information contained in the historical access record can point to the referenced page.

[0030] In this embodiment, the reference data corresponding to each page can include the number of times each page is referenced. Specifically, each record in the historical access record can be traversed, and the number of times each page is accessed and referenced in the historical access record can be counted. Specifically, in the historical access record, when the page identifier of a preset page appears in the accessed page field of a record, the access count of the preset page can be incremented by 1; when the page identifier of a preset page appears in the referenced page field of a record, the reference count of the preset page can be incremented by 1. In this way, after counting each access record one by one, the number of times each page is accessed and referenced in the user's historical access record can be obtained.

[0031] It should be noted that in some access records, the accessed page may not have a corresponding referencing page. In such cases, the referencing page field in these access records can be empty. For example, in an access record where the accessed page is www.jd.com, and the user accesses this page by directly entering the URL of www.jd.com into their browser, then the referencing page field will not exist in this access record.

[0032] In this embodiment, the reference data corresponding to each page may further include the referencing pages corresponding to each page. Specifically, each record in the historical access record can be traversed, the number of times each page is accessed in the historical access record can be counted, and the referencing pages corresponding to each page can be recorded. Specifically, in the historical access record, when the page identifier of a preset page appears in the accessed page field of a record, the number of times the preset page is accessed can be incremented by 1. When the page identifier of a preset page appears in the referencing page field of a record, it indicates that the preset page can be used as the referencing page of the currently accessed page in that record. In this way, after counting each access record one by one, the number of times each page is accessed in the user's historical access record and the referencing pages corresponding to each page can be obtained.

[0033] It's also important to note that in some access records, the accessed page may not have a corresponding referencing page. In such cases, the referencing page field in these access records can be empty. For example, in an access record where the accessed page is www.jd.com, and the user accesses the page by directly entering the URL www.jd.com into their browser, then the referencing page field will not exist in this access record. In other words, not all pages have referencing pages.

[0034] S5: Based on the number of times each page is accessed and the reference data corresponding to each page, detect abnormal access pages from the historical access records.

[0035] In this implementation, since pages with abnormal access typically cannot be displayed correctly, they generally cannot be referenced by other pages. In other words, when a preset page is one that cannot be displayed correctly, its corresponding number of references should be zero. Based on this, the number of times each page is referenced can be used to determine which pages are considered abnormal access pages.

[0036] In this implementation, detecting abnormal page access solely based on the number of times a page is referenced would incorrectly classify normal pages as abnormal. This is because when a user accesses certain normal pages, they may not have used those pages to access other pages, meaning those normal pages haven't been referenced by other pages. Therefore, relying solely on the number of page references would erroneously classify normal pages as abnormal.

[0037] In this embodiment, to reduce false positives, the number of times a page is accessed can be considered when detecting abnormal access pages based on the number of times the page is referenced. Specifically, when the number of times a preset page is accessed is greater than or equal to a preset threshold, and the preset page is not referenced by other pages, the preset page can be determined as an abnormal access page.

[0038] In this embodiment, the preset threshold can be determined based on the number of a user's historical access records. Specifically, a judgment ratio coefficient can be preset, and the preset threshold is obtained by multiplying the number of a user's historical access records by the ratio coefficient. Thus, when the number of times a preset page is accessed is greater than or equal to the preset threshold, it indicates that the preset page has a large number of access records. At this time, if the preset page is not referenced by other pages, it can be determined that the preset page is an abnormal access page.

[0039] In this embodiment, abnormal access pages can also be generated automatically through data interaction between the website's server and the user's client. Therefore, abnormal access pages typically do not have corresponding referencing pages. That is, when a preset page is an abnormal access page, it does not have a corresponding referencing page. Based on this, it is possible to determine which pages are abnormal access pages by looking at the referencing pages corresponding to each page.

[0040] In this implementation, if abnormal access pages are detected solely based on the referencing pages for each page, normal pages will be incorrectly identified as abnormal access pages. This is because users may access normal pages by directly entering their URLs into their browsers. If abnormal access pages are detected only based on their referencing pages, these normal pages will be incorrectly identified as abnormal access pages.

[0041] In this embodiment, to reduce the possibility of false positives, the number of times a page is accessed can be considered when detecting abnormal access pages based on the referenced pages for each page. Specifically, when the number of times a preset page is accessed is greater than or equal to a preset threshold, and the preset page does not have any referenced pages, the preset page can be determined to be an abnormal access page.

[0042] In this embodiment, the preset threshold can be determined based on the number of a user's historical access records. Specifically, a judgment ratio coefficient can be preset, and the preset threshold is obtained by multiplying the number of a user's historical access records by the ratio coefficient. Thus, when the number of times a preset page is accessed is greater than or equal to the preset threshold, it indicates that the preset page has a large number of access records. At this time, if the preset page does not have a referencing page, the preset page can be determined as an abnormal access page.

[0043] In this embodiment, after detecting an abnormal access page, the access record containing the page identifier of the abnormal access page can be deleted from the user's historical access record, so that the user's behavior can be correctly analyzed.

[0044] In a specific application scenario, historical access records generated when a user visits the JD.com website can be obtained. Each access record can include the URL of the accessed page and the URL of the referencing page. Specifically, the URL of the referencing page can be in the header of the access record. The header may contain a referer field, where the URL of the referencing page can be entered. In this application scenario, each user's historical access record can be identified individually. When the page identifier of a preset page appears in the accessed page field of a record, the access count of that preset page is incremented by 1; when the page identifier of a preset page appears in the referer field of a record, the reference count of that preset page is incremented by 1. By counting each access record individually, the number of times each page was accessed and referenced in the user's historical access records can be obtained. Specific statistical results are shown in Table 1.

[0045] Table 1 shows the number of times each page was accessed and referenced in the historical access records.

[0046]

[0047]

[0048] As can be seen from Table 1, www.jd.com / b was accessed extensively but was not referenced by any other pages, indicating that this page could be considered an abnormal page.

[0049] In one embodiment of this application, the reference information of accessed pages in the historical access record can be obtained from the user's client via a script. Specifically, when a user accesses the current page through the client, a page access request can be sent to the server of the current page. Simultaneously, the client can also locally store the page identifiers of the referenced pages of the current page, and these page identifiers can serve as the reference information corresponding to the current page.

[0050] In this embodiment, the website server, in response to a page access request from a user's client, can send page information back to the user's client. This page information may include a script for retrieving reference information. The script can be a code segment edited in a preset programming language and executable by the user's client. For example, the script can be a JavaScript script or a PHP script.

[0051] In this embodiment, when a user's client receives page information with an added script from the server, the script can be executed automatically. During execution, the script can obtain client information. This information may include, for example, browser version information, cookie information, current page reference information, and access time information. Thus, the client can send the reference information of the current page pointed to by the page access request to the website's server. After receiving the reference information sent by the user's client after executing the script, the server can write the received reference information and the current page information from the page access request together into the user's historical access record.

[0052] Please see Figure 2 In one embodiment of this application, a user's historical access records can be processed by constructing a page access path tree. The page access path tree can include page nodes of each page and the connection relationships between the pages. Specifically, in this embodiment, the user's page access path tree can be generated based on the historical access records. The page access path tree includes at least one page node, wherein page nodes with referencing relationships have path connections between them, and the path connections point from the referenced page node to the accessed page node.

[0053] In this embodiment, each page in the historical access record can correspond to a page node. Each page node can represent a page that has been accessed, or a page that has been referenced. For example, ... Figure 2As shown, in one access record, www.jd.com can be the accessed page, and its corresponding referenced page can be www.google.com, indicating that in this access record, www.jd.com is linked from www.google.com. In another access record, www.jd.com / a can be the accessed page, and its corresponding referenced page can be www.jd.com, indicating that in this access record, www.jd.com / a is linked from www.jd.com. In yet another access record, www.jd.com / b can be the accessed page, and its corresponding referenced page can be www.jd.com, indicating that in this access record, www.jd.com / b is linked from www.jd.com.

[0054] As can be seen from the above, for the same page address, it can be either the visited page or the referenced page in different access records. In this embodiment, page nodes with a referencing relationship can refer to a situation where one page node corresponds to the currently visited page, and the other page node corresponds to a page referenced by the currently visited page. Thus, the path connection between page nodes can represent this referencing relationship, where the path connection can be a directional line pointing from the referenced page node to the visited page node.

[0055] In one embodiment of this application, when constructing the page access path tree, each record in the historical access records can be sorted according to its access time. The access time can be the point in time when the user's client sends a page access request to the website's server. Sort each record according to its access time to follow the browsing order of the user when accessing the website.

[0056] In this embodiment, after sorting each record in the historical access log, each record can be traversed, and a corresponding page node can be created for the accessed page / referenced page in each record. To avoid duplicate creation of page nodes, it can be determined whether a page node exists for the accessed page / referenced page in the current record. If a page node exists for the accessed page / referenced page, it does not need to be created again.

[0057] In this embodiment, corresponding page nodes can be created for accessed pages / referencing pages that do not have page nodes in the current record, and a path connection can be established between the page nodes of the referencing page and the page nodes of the accessed page. For example, in the current access record, the accessed page is www.jd.com, and the referencing page of this accessed page is www.baidu.com. Since www.baidu.com already has a page node, it does not need to be created again. However, www.jd.com does not have a page node, so a page node corresponding to www.jd.com can be created. In this access record, www.jd.com is linked from www.baidu.com, so a path connection can be established between the page nodes of www.jd.com and the page nodes of www.baidu.com. The direction of this path connection can be from the page node of www.baidu.com to the page node of www.jd.com. In this way, the above process of creating page nodes and establishing path connections is performed for each access record in the historical access record, thereby generating the page access path tree corresponding to the user's historical access records.

[0058] In one embodiment of this application, each page node in the page access path tree can correspond to both the number of times it has been accessed and the number of times it has been referenced. If a page node already exists for the accessed / referenced page in the current record, the number of times it has been accessed / referenced can be incremented by one. Thus, after the page access path tree is created, each page node can correspond to the total number of times it has been accessed and referenced. Therefore, when counting the number of times each page has been accessed in the historical access records, the number of times each page node in the page access path tree has been accessed can be counted. Similarly, when counting the number of times each page has been referenced, the number of times each page node in the page access path tree has been referenced can be counted.

[0059] In one embodiment of this application, when recording the referenced pages corresponding to each page, each page node in the page access path tree can be traversed, and each page node referenced by the current page node can be recorded. Thus, the page corresponding to the recorded page node can be used as the referenced page corresponding to the current page. After statistically analyzing each page node in the page access path tree, the referenced pages corresponding to each page can be obtained.

[0060] Please see Figure 3 This application also provides a device for detecting abnormal access to pages, the device including a network communication port 110 and a processor 210.

[0061] The network communication port 110 is used for network data communication.

[0062] The processor 210 is configured to acquire the user's historical access records through the network communication port, the historical access records including the page identifier of the currently accessed page and the reference information of the currently accessed page; based on the page identifier and the reference information, count the number of times each page is accessed in the historical access records and record the reference data corresponding to each page; and detect abnormal access pages from the historical access records based on the number of times each page is accessed and the reference data corresponding to each page.

[0063] In this embodiment, the network communication port 110 can refer to a hardware port or a software port. The hardware port can be a USB port, a serial port, etc. The software port can be a communication protocol port for connection-oriented and connectionless services in the network. The communication protocol can, for example, include TCP / IP or UDP.

[0064] The processor 210 can be implemented in any suitable manner. For example, the processor can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers, etc. This application is not limiting.

[0065] The specific functions implemented by the network communication port 110 and the processor 210 of the detection device disclosed in the above embodiments can be explained in contrast to the implementation of the abnormal access page detection method in this application. It can realize the implementation of the abnormal access page detection method in this application and achieve the technical effects of the implementation method.

[0066] Please see Figure 4 This application also provides a data analysis method, which may include the following steps.

[0067] S61: Obtain the user's historical access records, which include the page identifier of the accessed page and the reference information of the accessed page.

[0068] S63: Based on the page identifier and the reference information, count the number of times each page is accessed in the historical access record and record the reference data corresponding to each page.

[0069] S65: Based on the number of times each page is accessed and the reference data corresponding to each page, detect abnormal access pages from the historical access records.

[0070] S67: Remove the data related to the abnormal access page from the historical access record to obtain the target business data.

[0071] S69: Perform data analysis based on the target business data.

[0072] In this embodiment, the reference data corresponding to each page may include: the number of times each page is referenced or the referenced pages corresponding to each page. The specific implementation of steps S61 to S65 can be found in the description of steps S1 to S5 above, and will not be repeated here.

[0073] In this embodiment, after detecting an abnormal access page, data related to the abnormal access page can be removed from the historical access record. Specifically, the data related to the abnormal access page may include the page identifier of the abnormal access page and / or the referencing information of the abnormal access page. The page identifier of the abnormal access page can be a string pointing to the abnormal access page. For example, the page identifier can be a Uniform Resource Locator (URL). The referencing information indicates which page the abnormal access page was linked from. The referencing information may include the page identifier of the parent page of the abnormal access page. For example, the page identifier of the abnormal access page may be www.jd-404.com, and the referencing information of the abnormal access page may include the page identifier of www.google.com. This indicates that the accessed page of www.jd-404.com was linked from www.google.com.

[0074] In this embodiment, after removing data related to the abnormal access page from the historical access records, the target business data can be obtained. The target business data may include information about access pages that can be displayed normally. This information may include the page's identifier, the time of access, the time spent on the page, and the page it references. By analyzing the target business data, the user's web browsing behavior characteristics can be obtained.

[0075] In this embodiment, the analysis of the target business data can include analyzing the user's search keywords from the target business data. Currently, search engines typically store the user's search keywords in the URL, allowing the extraction of user search keywords from the URL contained in the target business data. Specifically, the URL can store the user's search keywords using preset search keyword variables. In practical applications, different search engines may use different preset search keyword variables. For example, the preset search keyword variables may include / word / , / keyword / , / wordlist / , etc. The user's search keywords can be entered after these preset search keyword variables. The combination of the preset search keyword variables and the user's search keywords can be stored in the query field of the URL. Thus, by extracting the query field of the URL contained in the target business data and identifying the preset search keyword variables from the extracted query field, the search keywords contained in the target business data can be obtained. After obtaining the user's search keywords, the website server can statistically analyze the most frequently searched keywords and automatically push these keywords to users in the search bar on the website's homepage.

[0076] In this embodiment, the analysis of the target business data may further include statistically analyzing the pages that users are most interested in. Specifically, within the target business data, the number of times each page is accessed and the duration of each page's access can be counted. After the statistics are compiled, the accessed pages in the target business data can be sorted according to the number of accesses and the duration of access, respectively. In this way, the accessed pages contained in the target business data can be sorted by the number of accesses or the duration of access, thereby recommending pages with higher access counts and longer access durations to users. Of course, in practical application scenarios, accessed pages can also be sorted according to other criteria. For example, the number of clicks by users on each accessed page can also be used to sort the accessed pages; this application does not limit the sorting method.

[0077] As can be seen from the above, the method, apparatus, and data analysis method for detecting abnormal access pages provided in this application analyze the accessed and referenced pages in a user's historical access records. This allows for the detection of abnormal access pages based on the number of times each page is accessed and referenced. The method, apparatus, and data analysis method provided in this application can automatically analyze historical access records, avoiding manual detection and thus improving the efficiency of abnormal access page detection, and consequently, the efficiency of data analysis.

[0078] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (e.g., a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program a digital system themselves to "integrate" it onto a PLD, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog2. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0079] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0080] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. In particular, the embodiments for the detection device can be explained by referring to the descriptions of the aforementioned method embodiments.

[0081] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc.

[0082] This application can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0083] Although this application has been described through embodiments, those skilled in the art will know that this application has many modifications and variations without departing from the spirit of this application, and it is intended that the appended claims cover such modifications and variations without departing from the spirit of this application.

Claims

1. An access record processing method characterized by comprising: The method for determining the abnormal access page due to the automatic data interaction between the server of the website and the client of the user from the historical access records of the user, the method comprises: obtaining the historical access records of the user; the historical access records comprise the page identifier of the access page and the reference information of the access page; generating the page node corresponding to the access page and / or the reference information; determining the connection relationship between the page nodes based on the reference information of the access page; constructing the page access path tree according to the page node and the connection relationship between the page nodes; wherein, the page access path tree comprises the page node and the path connection line; the page access path tree is constructed according to the page node and the connection relationship between the page nodes, which comprises establishing the path connection line between the page nodes according to the connection relationship, and the path connection line is from the referenced page node to the accessed page node; the page node corresponds to the access times and the reference times; the method further comprises: when the access times of the page node of the preset page is greater than or equal to the preset threshold value, and there is no path connection line from the page node of other page to the page node of the preset page, determining the preset page as the abnormal access page according to the page access path tree and the access times of the page node corresponding to the page access path tree; and / or, when the access times of the page node of the preset page is greater than or equal to the preset threshold value, and the reference times of the page node is zero, determining the preset page as the abnormal access page according to the access times of the page node corresponding to the page access path tree and the reference times of the page node; wherein, when the access times of the preset page is greater than or equal to the preset threshold value, it indicates that there are a large number of access records of the preset page in the historical access records.

2. The method of claim 1, wherein, The reference information comprises the page identifier of the application page of the access page.

3. The method of claim 1, wherein, Before the page node corresponding to the access page and / or the reference information is generated, the method further comprises: sorting all the historical access records based on the access time of each historical access record; correspondingly, the page node corresponding to the access page and / or the reference information is generated, which comprises: generating the page node corresponding to the access page and / or the reference information based on the sorting of the historical access records.

4. The method of claim 1, wherein, The page node corresponding to the access page and / or the reference information is generated, which comprises: when there is no page node corresponding to the access page and the reference information in the current historical access record, the page node corresponding to the access page and / or the reference information is generated.

5. The method of claim 1, wherein, The page node also corresponds to the reference times, and the page node corresponding to the access page and / or the reference information is generated, which comprises: when there is the page node corresponding to the access page in the current historical access record, the access times of the page node is increased once, and / or, In the presence of a page node corresponding to the reference information in the current historical access record, the referenced times of the page node are increased by one.

6. The method of claim 1, wherein, After the page access path tree is constructed according to the connection relationship between the page nodes, the method further comprises: traversing each page node in the page access path tree to obtain the corresponding reference page of each page according to the page node referenced by the page node.

7. An access record processing apparatus characterized by comprising: The device is applied to the automatic data interaction between the server of a website and the client of a user, and needs to determine the abnormal access page generated due to the automatic data interaction between the server of a website and the client of a user from the historical access record of the user, and the device comprises: a historical access record obtaining module configured to obtain the historical access record of the user; the historical access record comprises the page identifier of an access page and the reference information of the access page; a page node generating module configured to generate a page node corresponding to the access page and / or the reference information; a connection relationship determining module configured to determine the connection relationship between the page nodes based on the reference information of the access page; a page access path tree constructing module configured to construct a page access path tree according to the page nodes and the connection relationship between the page nodes; The page access path tree comprises page nodes and path connections; the page access path tree is constructed according to the connection relationship between the page nodes, which comprises establishing path connections between the page nodes according to the connection relationship, and the path connections are from the referenced page nodes to the accessed page nodes. The page node corresponds to the accessed times and the referenced times; the page access path tree constructing module is further configured to: determine the preset page as an abnormal access page when the accessed times of the page node of the preset page are greater than or equal to a preset threshold, and there is no path connection from the page node of other pages except the preset page to the page node of the preset page according to the page access path tree and the accessed times of the page node in the page access path tree; and / or, determine the preset page as an abnormal access page when the accessed times of the page node of the preset page are greater than or equal to a preset threshold, and the referenced times of the page node are zero according to the accessed times and the referenced times of the page node in the page access path tree; When the accessed times of the preset page are greater than or equal to a preset threshold, it indicates that there are a large number of access records of the preset page in the historical access record.

8. A computer-readable storage medium, characterized in that, A computer readable storage medium has computer instructions stored thereon, and the instructions are executed to implement the steps of the method in any one of claims 1 to 6. A computer readable storage medium has computer instructions stored thereon, and the instructions are executed to implement the steps of the method in any one of claims 1 to 6.

Images